CRITICAL 9.8 CVE-2026-111693 Published 16 Oct 2026

DataBuff ai-apm-web Hard-coded Default Credentials Vulnerability

Worried this affects your website?

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability.

An unauthenticated attacker can use the built-in admin/Databuff@123 account.
POSTing these credentials to /webapi/api/v1/auth/login obtains an administrator token.
The token grants access to all protected /webapi routes.